Who does Role Design in SAP

Hi Experts,
Please let me know who does role design in SAP? I mean who is responsible for role designing in an SAP implementation project? Whether he is BASIS or Functional consultant.
Please let me know your valuable answer ASAP.
Thanks,
Sudip...

Hi Sudip,
Yes basis consultants are responsible to design roles according to the requirement or at the time of user create for the first time.The basis team designed a role according to different modules of SAP like PP,MM,PS etc.Again Basis consultant create new roles according to the requirement of the user.
But at times functional consultants are also able to give or design a role according to requirement.
So,first time when user crated it was the basis consultant who design the role and later when it requires, it was functional or basis guys are able to design the role.

Similar Messages

  • Role designing in SAP

    Hi Experts,
    Please let me know who does role design in SAP? I mean who is responsible for role designing in an SAP implementation project? Whether he is BASIS or Functional consultant.
    Eg. To create a SD role for the business how come basis or security consultant will know the authorization about SD tcode. As far as my knowledge goes Functional consultant will design his module's role and at last he will handover it to the BASIS or security consultant to create the role in the system using pfcg.
    Please let me know your opinion.
    Thanks,
    Sudip.

    Hi ,
    You are right.
    We will be getting the information from the Business side the list of Users who shall
    a)Create only Sales Order,
    b)Managers who can approve Credit Limit
    c) Accountants who can Create Billing document etc.
    All these informations which are collected for every module in scope of the
    implemented business scenario will be handed over to the BASIS Team
    who control them through appropriate authorisation.
    Authorisation Profile are created and added to each End Users ID which will control their Authorizations.
    Regards,
    Ravi

  • How does my role as a SAP SECURITY ADMIN dfiffre frm upgrade n implementati

    hi Gurus ,
    i am new to this Security i just want to know how does my role as a security admin differ ..in a implementation project and in a upgrade project ........pls answer this ..............n can i get any doc abt the tables n the objects .............related to security .......................  any links or docs u can mail me at [email protected]
    thank you

    A few inputs from my end....
    Implementation --> starting from role naming conventions to role design,sod conflicts, master child relations and documentation.
    Upgrade --> If from 4.0 versions to higher versions then its something similar where we convert profiles to Roles and then redesign them to SOD conflicts..
    But in case of higher upgrades then the java component access and the segregation of duties for these components as well have to be considered...
    Hope it helps...
    Vbr,
    Sri
    Award points for helpful answers

  • Business Process Role Design

    Hi all,
      I am infant in SAP world. I am looking for best practices or templates in order to define and document business process roles. Our strategy is to create roles by function. Look at the company organization chart and the various functions and accordingly roles. I am in charge of doing the functional documentation. I wanted to know if anyone has experience in document business function role design or a template that they can share.
    I would appreciate any help in this area. Thanks.
    Regards,
    Sara

    A.General
    1.
    Expression of one's responsibility would not dwell merely on actions but end results!
    2
    Responsibilities may be Technical,Administrative,Functional,Managerial,Financial and so on.
    It is better to classify for better understanding and to assign priority.
    3
    The document describing the Role would serve for reference, for training, for evaluation of performance and many more.
    B.Carrying out the task
    Having realized the significance of designing the Role some of points to be kept in view are as follows:
    1
    A template may contain the following heads:
    - Role title/Designation/Position name
    - Summary of responsibilities
    - Equipment/Budget level/People/Places for which responsible
    - Activities in the Role
    - Out put of the Role's function
    - Internal/external customers
    2
    To design business process roles, one must know the processes in greater detail collected by reading, visiting,discussing, interviewing concerned people.
    3
    Details may be collected by asking simple questions and eliciting simple answers. The answers may relate to Planning, Doing, Checking.
    High order terms must be avoided at this stage.
    4
    When the out come of one level activities is described in higher level abstraction, it becomes the responsibility of the higher level.This way, role description in one level after another is built up.
    5
    The out put of one Role must be input for another role.One must be conscious of this while describing a role.This is helpful to the business.
    Sam Anbazhagan
    Edited by: Anbazhagan Sam Venkatesan on Sep 8, 2008 4:11 PM
    Edited by: Anbazhagan Sam Venkatesan on Sep 9, 2008 4:37 PM

  • Need Role Design for Oil and Gas industry

    Hi All,
    i have a requirement of designing roles for Oil and Gas industry. Could any one share some material/link or overview on the same.
    if not all, Role Design on UOM is also fine
    regards
    Plaban

    Hi Mythily,
    If you already know something about explortion of oil, then you will find PRA (production and revenue acconting) interesting. This module deals with exploration of oil and gas and then distributing the revenue to owners.
    You can find detailed information in help.sap.com. Follow the link given below for PRA help:
    http://help.sap.com/saphelp_oil46csp2/helpdata/en/ec/9d2c3adcc8431be10000000a114084/frameset.htm
    Reading some of the material will give you more clarity whether you like it or not.
    And it is perfectly fine to have ABAP knowledge, that will help in going deep into Oil and gas.
    Rgds,
    Abhishek

  • 'Change your password' error when log to designer using SAP Authentication

    Hi All,
    Here is the scenario. I want to create a universe on BW.
    1. I try to log into designer using SAP authentication (by choosing SAP as the authentication option)
    2. In the system name its the name of the CMS
    3. The username and password that I entered were for my SAP system. (Yes, my SAP role is already present in CMC)
    4. After I entered, I got a message saying ' You must change your password to continue. If you do not change your password, your account might get disabled'.
    5. I am prompted with dialogue box to change my password.
    6. After I enter a new password (fairly complicated), it gives an error Failed to change password/ Details : [repo_proxy 15]. Sessionfacade:: changePassword - User password has not been updated (Incorrect password).
    I know that's not the case because I am able to log into SAP GUI and into CMC using my SAP credentials.
    Any advice please ? Why is this happening in designer ?

    Hi,
    Your issue may be fixed in FP1.8 with the following reference:
    ADAPT01229385
    Description:
    +If an Enterprise alias is created for a SAP user accounts in the Central Management Console (CMC), and set to change their+
    +passwords at the next log on, the SAP users may be unable to log on to applications with their SAP credentials.+
    +This problem happens even after the Enterprise alias is removed from the SAP user accounts in the CMC.+
    I hope this helps.
    regards,
    Henry

  • Performance and configuration Adobe LiveCyce Designer for SAP

    Hi there,
    I have a question for LiveCycle Designer for SAP. If the SAP system, a very large amount of data to the LiveCycle Designer is passed (eg data from over 1000 pages about 40,000 lines) then it comes to the following exception: com.adobe.ProcessingException: com.adobe.ads.exception.TransientException: A problem was encountered with the results: render Result array is null .; [Error Log file "2014.11.14.145246SAFPFILE1.pdf" written to F: \ usr \ sap \ R44 \ SYS \ global \\ Adobe Document
    For smaller amounts of data from SAP, it goes without problems.
    Does anyone know the settings in SAP or by Adobe LiveCyle designer?
    Is there such a thing as a limitation of number of rows? Or is there a limit on the size of the transferred data from SAP?
    What would be a possible solution?

    Did you raise this SAP via an OSS message?
    Chintan

  • SRM role design

    Hi All,
    I have few queries regarding SRM role Design.
    - I do not find WebDynpro applications for certain requirement, like Create Contract. How do i add this requirement? FYI,  SAP standard role uses Floor Plan Manager '/SAPSRM/WDA_L_FPM_OIF' and has named it Contract Details. Is this correct?
    - There are no Authorization objects which come automatically on adding a WebDynPro application. Do I need to configure SU24 for each WebDynPro? I do not think it is to be done, since in SAP standard role, auth. objects have been added manually.
    - How is a Business role on EP linked with its corresponding SRM role?
    - Do i need to use BSP applications also?
    - i have requirement to create SRM MDM role and SRM role. So, is SRM MDM role also to be created on SRM server?
    Regards

    Which transaction(s) are the user ID´s designed to use for this?
    Can it be assumed that the "billing" is resulting from the "dispatching" (Warenausgang) or a milestone of some project?
    Where is the user and the role?
    Sorry I dont understand the question. Perhaps you should first ask functional questions about this in the Sales and Distribution type of forums to get a real technical feasability answer, then attempt an authorization (role) to enable it.

  • Role Design Startegy

    Hi All,
    Any insights are greatly appreciated
    I am  strong believer that SAP Security role design startegy should be simple and  easy to manage with single roles rather than having composites. At current cleint, I tried to sell this idea and tried to avoid composite role design because of problems I have seen after go-live (SODs, maintainence issues, problem analysis effort)
    For some inexplicable reasons, I did not succeed completely now we are building roles with 3 tiers, 1 tier being common access role- single, second being display -single and 3 tier is composite role for each job function , having a combination of different task-based process roles . This is n+1 implementation with global roll out followed by individual markets. There will another tier of roles developed on need basis during blueprint of different market roll-outs
    Can anyone give me inputs if this kind of composite approach combined with 3-tier have been used and what will be potential nightmares after go-live
    Thanks in Advance

    I would suggest that it will depend quite a bit upon the business requirements, but a lot more on how many staff there are; potentially on how many roles would end up being created.
    However, when I set-up our roles, I used only single roles (no composite) and that has worked well (150+ users at the moment, more to be added later, possibly up to 450) There is an arguement for saying that we could easily switch to composite roles now, but we still get quite a bit of role movement and keeping them as single roles has proven to be better. Perhaps in a few years if it settles down we may then look at it again.
    Our roles are based upon job function, but in some cases, we have a "clerk", "supervisor", & "manager" role. The user in the supervisor function would have both "clerk" and "supervisor" role, but not manager. We also have some generic roles e.g. "purchase requisition" which are used by a larger number of people. This allows the specific items to be managed in one role rather than in say 8 or 10 roles.
    Each role can then have different t-codes or authorisations; as they are cumulative, that gives the required access to do the job. It's also fairly easy to test that the role is working as we want it to do.
    It took a while to get it right, but now it seems to be working really well for us. Moving people between job functions is really straight forward and easy to do. It's also very easy to add new users and will prove to be very easy as the new staff get added over the next few years.
    I would suggest that the old axiom is true; the more work you do at the beginning, the less you will have to do afterwards.
    Regards
    Tony

  • Job role design - transaction role and auth object role

    Hi all, please kindly comment following job role design:
    (1) transaction role:
    Keep transactions in single job role to represent business processes in different application areas, e.g.MM: maintain PR, PO, OA.   CO: maintain cost center, internal order   HR: maintain org structure, personnel management.
    The single job role will only keep role menu, object S_TCODE and inactivated all other application related authorization objects.
    (2) authorization role
    Keep application component related authorzation objects except S_TCODE in single job role by different application area, e.g. Objects of MM_B, MM_E, MM_G in MM role. Objects of K_CCA, K_CSKS_SET in CO role.  Objects of HR in HR role.
    Then maintain org level of MM, CO, HR roles for different companies, e.g. Company A MM role, company A CO role, company A HR role, company B MM role.;....
    User will be assigned transaction role + auth object role.   For example, user of company A to perform MM and CO functions will be assigned
    with MM transaction role + company A MM role + company A CO role.
    Please let me know the pros and cons of above design.  Thanks.
    Regards,
    Donald
    * I can see the disadvantage of this design is during SAP upgrade (SU25), revised of authorization object will not reflect in authorization role

    Brent Van Dyck wrote:
    Keep in mind the project was for an HCM implementation where there's already hardly any connection between tcodes and authorization values so it may have made more sense in that context than it would in a classic SD/MM.
    That is correct - but it still exceeds "horrible" beyond imaginable boundaries if you try to split the fields of the objects into different roles and expect it to work or that there will be less roles.
    In the case of HCM and also BW the auths admin needs to know more about the data and organization than what classic ERP auths admins can get away with. That is why they take longer to migrate away from manual profiles and have a greater tendency to have manual authorizations inserted into roles - which could however also be achieved by maintaining fields proposed without values and at least proposing those (such as activity type fields) which are known.
    But splitting cube / characteristics / key figures  or infotype / personel group / auth code into different roles can only go wrong.
    Another mistake some "value role experts" sometimes make is that they don't want Su24 proposals in PFCG because they don't understand them. So what they do is that they clean out the SU24 tables completely... Well... the side affect of that is that all SU24 check indicators flagged as "no check" suddenly become alive in their system although there are mostly good reasons not to have the checks active.
    Cheers,
    Julius

  • Feedback thread for "How To Design a SAP NetWeaver - Based System Landscape

    I have just published a RIG How To Guide called [How To Design a SAP NetWeaver - Based System Landscape|https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/50a9952d-15cc-2a10-84a9-fd9184f35366].  You can read my [blog |http://www.sdn.sap.com/?blog=/cs/weblog/view/wlg/8877]on it.  This thread is collect feedback and discussion on the Guide.

    Hi Matt!
    This is definitely interesting reading and a lot of projects I've been in could have benefitted from it had it been carefully read beforehand by some of the involved parties.
    What I like especially is the fact that this is not only for technical consultants (who should know about most of these things anyway) but for the people closer to the business who need to find agreements with the technical guys.
    Good job...
    Jörg
    Some comments to what I read:
    I noticed that you use the term 'server virtualization' (section 3.3.1) quite generally. Maybe it would be worth introducing the term 'server consolidation' (which you use later in the document)  already in this early chapter. My experience shows that (especially recently) a lot of customers are interested in 'virtual servers' (meaning a virtual server with an OS installed separately), not really knowing what they're talking about and often better advised to use 'server consolidation' (one OS, many SIDs). These two concepts are similar in terms of sharing hardware resources, but quite different in terms of the implications toward administration.
    In section 4.2.1.3 you mention (in brackets) the Usage type to which the client belongs for the Business Explorer  and the J2SE Adapter Engine if I understood that correctly. There is no UT mentioned for the other clients and there is no explanation on what the bits in brackets are supposed to mean. (I first expected the 'BeX' abbreviation when I saw something in brackets...)

  • Accessing Query Designer through SAP Menu

    Is there a way to acces Query Designer through SAP Menu other than the usual Windows -->Start menu...?

    Hi,
    You can add the Query Designer by right-clicking on the favorites and choose "Add other objects" and then "Web address or file". From there, enter the path to the Query Designer. Usually, it is:
    "C:Program FilesSAPBusiness ExplorerBIBExQueryDesignerStarter.exe"
    but to be sure, look in the properties of your Query Designer icon.
    A follow up question on this: Does someone know if it is possible to pass the userid and password in this link? By following my instructions above, you will always need to enter uid and password to open Query Designer...
    Regards,
    Håkan

  • Why is my macbook pro running slow.  It runs slow even if only one app is open, especially if it's a browser.  I don't know how to read Etrecheck, but was hoping someone who does can help me out.  Would be super grateful.  :-)

    Hi.  This is my first time posting.  My Macbook Pro with Os X Mavericks has been running super slow since before I installed Mavericks so I'm pretty sure it's not the OS that has the problem.  It runs slow even if only one app is open, especially if it's a browser, particulary google chrome.  If mail is open...forget about it, down to a crawl.  I don't know how to read Etrecheck, but was hoping someone who does can help me out.  Would be super grateful.  :-)
    P.S. - Also, it sounds like something is loose inside my mac.  How should I proceed?
    Thanks in advance.
    Hardware Information:
              MacBook Pro (13-inch, Late 2011)
              MacBook Pro - model: MacBookPro8,1
              1 2.8 GHz Intel Core i7 CPU: 2 cores
              4 GB RAM
    Video Information:
              Intel HD Graphics 3000 - VRAM: 384 MB
    System Software:
              OS X 10.9.2 (13C1021) - Uptime: 0 days 23:21:37
    Disk Information:
              APPLE HDD HTS547575A9E384 disk0 : (750.16 GB)
                        EFI (disk0s1) <not mounted>: 209.7 MB
                        Macintosh HD (disk0s2) / [Startup]: 749.3 GB (603.2 GB free)
                        Recovery HD (disk0s3) <not mounted>: 650 MB
              MATSHITADVD-R   UJ-8A8 
    USB Information:
              Apple Inc. Apple Internal Keyboard / Trackpad
              Apple Inc. BRCM2070 Hub
                        Apple Inc. Bluetooth USB Host Controller
              Apple Inc. FaceTime HD Camera (Built-in)
              Apple Computer, Inc. IR Receiver
    Thunderbolt Information:
              Apple Inc. thunderbolt_bus
    Gatekeeper:
              Mac App Store and identified developers
    Kernel Extensions:
              [not loaded] com.leapfrog.driver.LfConnectDriver (1.8.0 - SDK 10.7) Support
              [not loaded] com.seagate.driver.PowSecDriverCore (5.0.1) Support
              [not loaded] com.seagate.driver.PowSecLeafDriver_10_4 (5.0.1) Support
              [not loaded] com.seagate.driver.PowSecLeafDriver_10_5 (5.0.1) Support
              [not loaded] com.seagate.driver.SeagateDriveIcons (5.0.1) Support
    Problem System Launch Daemons:
              [failed] com.apple.wdhelper.plist
    Problem System Launch Agents:
              [loaded] com.paragon.NTFS.auth.plist Support
    Launch Daemons:
              [loaded] com.adobe.fpsaud.plist Support
              [loaded] com.google.keystone.daemon.plist Support
              [loaded] com.leapfrog.connect.shell.plist Support
              [loaded] com.macpaw.CleanMyMac2.Agent.plist Support
              [loaded] com.microsoft.office.licensing.helper.plist Support
              [running] com.sophos.autoupdate.plist Support
              [running] com.sophos.intercheck.plist Support
              [running] com.sophos.notification.plist Support
    Launch Agents:
              [not loaded] com.adobe.AAM.Updater-1.0.plist Support
              [loaded] com.google.keystone.agent.plist Support
              [running] com.seagate.SeagateStorageGauge.plist Support
              [running] com.sophos.uiserver.plist Support
              [running] org.chromium.chromoting.plist Support
    User Launch Agents:
              [loaded] com.adobe.AAM.Updater-1.0.plist Support
              [loaded] com.adobe.ARM.[...].plist Support
              [failed] com.adobe.ARM.[...].plist Support
              [loaded] com.facebook.videochat.[redacted].plist Support
              [loaded] com.macpaw.CleanMyMac2Helper.diskSpaceWatcher.plist Support
              [loaded] com.macpaw.CleanMyMac2Helper.scheduledScan.plist Support
              [loaded] com.macpaw.CleanMyMac2Helper.trashWatcher.plist Support
    User Login Items:
              Activity Monitor
              Dropbox
              Google Drive
              younity
              EvernoteHelper
    Internet Plug-ins:
              o1dbrowserplugin: Version: 5.2.4.18058 Support
              nplastpass: Version: 2.5.5 Support
              Default Browser: Version: 537 - SDK 10.9
              AdobePDFViewerNPAPI: Version: 11.0.06 - SDK 10.6 Support
              FlashPlayer-10.6: Version: 13.0.0.206 - SDK 10.6 Support
              Silverlight: Version: 5.1.20125.0 - SDK 10.6 Support
              Flash Player: Version: 13.0.0.206 - SDK 10.6 Support
              QuickTime Plugin: Version: 7.7.3
              googletalkbrowserplugin: Version: 5.2.4.18058 Support
              SharePointBrowserPlugin: Version: 14.4.1 - SDK 10.6 Support
              AdobePDFViewer: Version: 11.0.06 - SDK 10.6 Support
              JavaAppletPlugin: Version: 14.9.0 - SDK 10.7 Check version
    Safari Extensions:
              Slick Savings: Version: 1.0
              Slick Savings: Version: 1.0
              Surfon: Version: 1.2.2
              Pearltrees Extension: Version: 6.0.13
              Mindomo Bookmarks: Version: 1.0
              Ebay Shopping Assistant: Version: 1.1
              Zootool: Version: 0.7
              Amazon Shopping Assistant: Version: 1.1
              Pocket: Version: 1.7.1
              Searchme: Version: 1.3
    Audio Plug-ins:
              BluetoothAudioPlugIn: Version: 1.0 - SDK 10.9
              AirPlay: Version: 2.0 - SDK 10.9
              AppleAVBAudio: Version: 203.2 - SDK 10.9
              iSightAudio: Version: 7.7.3 - SDK 10.9
    iTunes Plug-ins:
              Quartz Composer Visualizer: Version: 1.4 - SDK 10.9
    User iTunes Plug-ins:
              TuneUp Visualizer: Version: 2.4.0 - SDK 10.6 Support
    User Internet Plug-ins:
              Picasa: Version: 1.0 - SDK 10.4 Support
    3rd Party Preference Panes:
              remoting_host_prefpane  Support
              Flash Player  Support
              Paragon NTFS for Mac ® OS X  Support
    Time Machine:
              Mobile backups: ON
              Auto backup: YES
              Volumes being backed up:
                        Macintosh HD: Disk size: 697.84 GB Disk used: 136.06 GB
              Destinations:
                        NO NAME [Local] (Last used)
                        Total size: 3.41 GB
                        Total number of backups: (null)
                        Size of backup disk: Too small
                                  Backup size 3.41 GB < (Disk used 136.06 GB X 3)
              Time Machine details may not be accurate.
              All volumes being backed up may not be listed.
    Top Processes by CPU:
                   6%          Activity Monitor
                   5%          WindowServer
                   1%          InterCheck
                   1%          sysmond
                   0%          ocspd
    Top Processes by Memory:
              152 MB          Finder
              115 MB          HelpViewer
              111 MB          mds_stores
              86 MB          InterCheck
              57 MB          WindowServer
    Virtual Memory Information:
              983 MB          Free RAM
              1.03 GB          Active RAM
              584 MB          Inactive RAM
              1.01 GB          Wired RAM
              17.41 GB          Page-ins
              222 MB          Page-outs

    Launch the Console application in any of the following ways:
    ☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
    ☞ Open LaunchPad. Click Utilities, then Console in the icon grid.
    Make sure the title of the Console window is All Messages. If it isn't, select All Messages from the SYSTEM LOG QUERIES menu on the left. If you don't see that menu, select
    View ▹ Show Log List
    from the menu bar.
    Click the Clear Display icon in the toolbar. Then try the action that you're having trouble with again. Select any messages that appear in the Console window. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.
    When posting a log extract, be selective. In most cases, a few dozen lines are more than enough.
    Please do not indiscriminately dump thousands of lines from the log into this discussion.
    Important: Some private information, such as your name, may appear in the log. Anonymize before posting.

  • How to find a customer who does not have any activity in the last 5 years

    HI all,
       How to find a customer who does not have any activity in the last 5 years.
    Thanks & Regards,
    Moderator message: not directly related to ABAP development, please have a look in the respective functional forum.
    Edited by: Thomas Zloch on Jan 3, 2011 2:20 PM

    Post Author: tzinser
    CA Forum: Formula
    Okay, I left off a lot of important information...
    I'm using two tables
    TWDATA
    EVENT
    From TWDATA I'm pulling the fields TWDATA.OrderNumber and TWDATA.DisbursementDate
    From EVENT I'm pulling the fields EVENT.EventCode and EVENT.CompletedDate
    The two tables are linked by OrderNumber.

  • Web-dynpro application -ERROR: ICF service node "/sap/bc/webdynpro/sap/zqm_cto_arr_general1" does not exist (see SAP Note 1109215) (termination: ERROR_MESSAGE_STATE)

    i have created my web-dynpro application in development. and sent to quality . whenever i will execute my dynpro in quality  i got one message
    ERROR: ICF service node "/sap/bc/webdynpro/sap/zqm_cto_arr_general1" does not exist (see SAP Note 1109215) (termination: ERROR_MESSAGE_STATE)
    whenever i saw  sicf  transaction my web-dynpro is not seen . my dynpro application name is more then 15 character. what i will do . please give me valuable suggestion.....

    Hi Ashok,
                   for your requirement the application is not exist in particular place. It means, the webdynpro application is saved at different package or different location.
                  Please change the webdynpro component name and save it in particular request in package, then transport it to quality ..(development server )
    then go to SICF  t.code .. sap->bc->webdynpro->sap->find  out your application and activate the service of your webdynpro application.
    Now test it ... this solution might helpful to you .
    Regards,
    Naveen M

Maybe you are looking for